Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fel: Add support for allwinner T7 #204

Merged
merged 2 commits into from
Jan 11, 2024

Conversation

qianfan-Zhao
Copy link
Contributor

uart0-helloworld-sdcard can work with this patch:

./sunxi-fel --verbose spl uart0-helloworld-sdboot.sunxi
Stack pointers: sp_irq=0x00022000, sp=0x00025E08
MMU is not enabled by BROM
=> Executing the SPL... done.

And next is the uart console's log:

Hello from Allwinner T7!
Returning back to FEL.

Copy link
Contributor

@apritzel apritzel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That looks mostly good, thanks for sending this! Some comments inside.

soc_info.c Outdated
* SRAM A1: 0x0002_0000 - 0x0002_7fff, 32K contains stacks
* SRAM C: 0x0002_8000 - 0x0004_ffff, 160K full access
* SRAM A2: 0x0010_0000 - 0x0010_3fff, 16K unknown part, the data was changed
* when read back
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the T7 have an OpenRISC management core? Then this will probably be its exception vector area, where only one word in every 256 byte region is writable, as seen in the other OpenRISC SoCs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had not find the OpenRISC core in the datasheet. I had write 16KB zero data to this section and then readback, next is the new data:

$ hexdump -C 2.bin
00000000  00 00 00 00 00 00 00 15  00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100  00 00 00 00 00 00 00 15  00 00 00 00 00 00 00 00  |................|
00000110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200  00 00 00 00 00 00 00 15  00 00 00 00 00 00 00 00  |................|
00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
...

Maybe there only one word in every 256 byte region is not writable. And I don't known what the means of 0x15.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes,that's exactly the OpenRISC exception vector pattern we see in the other SoCs, compare here: https://linux-sunxi.org/A64/Memory_map

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To elaborate: the first word is writable: that receives the branch instruction containing the target address of the exception handler. The 0x15000000 is the hardcoded NOP needed for the delay slot. The rest of each 256 byte region is not implemented and hardwired to 0.

soc_info.c Outdated
*/
sram_swap_buffers t7_sram_swap_buffers[] = {
/* 0x21C00-0x21FFF (IRQ stack) */
{ .buf1 = 0x21C00, .buf2 = 0x4d800, .size = 0x0400 },
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need such a large stack? Do you know the stack pointer value?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had write a tool like #130, write 1K random data everytime and then readback, when I write data to 0x21c00 the bootROM will hang. So I think this section size is 1K, maybe reducing the amount of data written each time will get a more accurate results, but that's not important.

when startting u-boot-spl in verbose mode, it will print the stack pointer value:

./sunxi-fel --verbose spl uart0-helloworld-sdboot.sunxi
Stack pointers: sp_irq=0x00022000, sp=0x00025E08
MMU is not enabled by BROM
=> Executing the SPL... done.

the sp_irq value can match it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the stack pointers! Yes, the IRQ stack looks correct, both the size and location. I was wondering about the normal stack, though. Can you dump the BootROM somewhere? The initial FEL stack pointers are pretty easy to find in the disassembly, then we could reserve 5K down from there, to be on the safe side, and make sure the 0x25e08 is in that region.

soc_info.c Outdated
.name = "T7",
.spl_addr = 0x20000,
.scratch_addr = 0x21000,
.thunk_addr = 0x4d200, .thunk_size = 0x200,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There seems to be a gap between this thunk area and the swap buffers. Is that intentional? Can we move this area here up to end at the swap buffer's start?

Copy link
Contributor Author

@qianfan-Zhao qianfan-Zhao Jan 5, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No enough reason. The swap buffer is started at 0x4d800 and I make the thunk address before swap buffer. And reserve some space if we need extended the thunk_size in the future. Or maybe set thunk_size to 0x600 is better?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All other SoCs use 0x200, and the current code uses much less than that, If we would need more, we would need to change the value for all other SoCs, too. So there is no reason to go beyond 512 bytes, or to reserve space already.

@@ -513,6 +515,10 @@ void gpio_init(void)
sunxi_gpio_set_cfgpin(SUNXI_GPE(2), SUN8I_R528_GPE_UART0);
sunxi_gpio_set_cfgpin(SUNXI_GPE(3), SUN8I_R528_GPE_UART0);
sunxi_gpio_set_pull(SUNXI_GPE(3), SUNXI_GPIO_PULL_UP);
} else if (soc_is_t7()) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That looks to be the same as the A64. Can you please double check and then just add soc_is_t7() to the existing A64 check?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure.

@qianfan-Zhao
Copy link
Contributor Author

Hi @apritzel , the attachment is the N-BROM dump with https://github.com/DrSchottky/Allwinner-BROM-dumper:

$ ./dump 0 0xc000 T7-N-BRROM.bin 
BROM magic (eGON.BRM) found!
BROM header starts at 0x3000
BROM header size is 36
BROM boot version is 1100
BROM eGON is 1100
BROM platform is 1633
BROM dumped successfully!

The BROM set SP to 0x27ffc in the address 0x00003294 and I am not a good hacker for arm asm, could you please check it again?

T7-N-BROM.bin.gz

@apritzel
Copy link
Contributor

Many thanks for the NBROM dump, that's very helpful!
So the FEL entry point is at 0x20, from there it branches to 0x70, and sets up the two stack pointers very early: the IRQ SP to 0x22000 (stored at 0x2ec), and the SVC SP to 0x27000 (stored at 0x2f0). Since the BROM also contains code for loading from MMC or NAND or SPI flash, there are more routines setting stack pointers, so I think the value you found belongs to other routines?
So with that it looks like just 5K would be enough. Can you check whether the area between 0x27000 and 0x28000 contains any data or is written to by the BROM during FEL operation? Then I guess we can reduce the stack backup buffer to 5K.

@qianfan-Zhao
Copy link
Contributor Author

@apritzel you are right that the SVC sp is started at 0x27000. We can touch the data between 0x27000 and 0x27c00.

$ ./check.sh 0x27000 0x27fff  
Check region(1K) 0x27000 ...........
Check region(1K) 0x27400 ...........
Check region(1K) 0x27800 ...........
Check region(1K) 0x27C00 usb_bulk_send() ERROR -7: Operation timed out
usb_bulk_send() ERROR -7: Operation timed out
sha1sum doesn't match

The swap buffer of T7 is much more like H6, 0x27c00 is someting important and we also can not touch it.

Allwinner T7 share the same CCM/UART base address with H6.
Add support for it in uart0-helloworld-sdboot.

Signed-off-by: qianfan Zhao <[email protected]>
Copied from allwinner t7 linux 4.9 sdk

Signed-off-by: qianfan Zhao <[email protected]>
Copy link
Contributor

@apritzel apritzel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, many thanks for checking all the regions, and for the changes! Looks all good now, I also checked the SID maps for overlaps.

@apritzel apritzel merged commit df60a46 into linux-sunxi:master Jan 11, 2024
1 check passed
@qianfan-Zhao qianfan-Zhao deleted the allwinner-t7 branch January 11, 2024 10:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants